| Package | Affected versions | Patched versions |
|---|
| nabeel/phpvms Packagist | < 7.0.6
| 7.0.6
|
Description
Security Advisory: Unauthenticated Access to Legacy Import Feature
Severity: Critical
Affected versions: phpVMS 7.x (up to 7.0.5)
Fixed in: v7.0.6
Component: Legacy importer
Summary
A critical vulnerability in phpVMS 7.x allowed unauthenticated access to a legacy import feature. Although this feature is deprecated, parts of it remained accessible and operational.
Impact
A remote attacker could trigger internal processes that modify or delete application data, potentially resulting in:
- Data loss
- Service disruption
No authentication was required.
Remediation
- Update immediately to the latest patched version
- If unable to update:
- The release link has instructions on how to fix it (it's a one-line fix to comment out the routes)
Affected Versions
- Affected: phpVMS 7.x ≤ 7.0.5
- Not affected: phpVMS >= 7.0.6, v8 (feature removed from public access)
NVD description
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been patched in version 7.0.6.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free